HOUSE BILL NO. 178

AMENDMENT IN THE NATURE OF A SUBSTITUTE

(Proposed by the House Committee on Education

on February 11, 2026)

(Patron Prior to Substitute—Delegate Anthony)

A BILL to amend the Code of Virginia by adding in Article 5 of Chapter 14 of Title 22.1 a section numbered 22.1-289.01:1, relating to public schools; student support agencies; memoranda of understanding.

Be it enacted by the General Assembly of Virginia:

1. That the Code of Virginia is amended by adding in Article 5 of Chapter 14 of Title 22.1 a section numbered 22.1-289.01:1 as follows:

§ 22.1-289.01:1. Student support agencies; memoranda of understanding.

A. As used in this section:

"Personal profile" does not include account information that is collected and retained by a student support agency and remains under control of a student, parent, or elementary or secondary school.

"Secure data transfer" means a method of transmitting data, including personally identifiable information, through the use of certain technical and organizational measures and protocols, including data encryption and authentication, to ensure that the integrity and confidentiality of such data is not compromised during such transfer and is only accessible by authorized recipients.

"Student personal information" means information collected through a student support program that identifies a currently or formerly enrolled individual student or is linked to information that identifies a currently or formerly enrolled student.

"Student support agency" means a nonprofit organization that provides student support programs to students enrolled in a public elementary or secondary school.

"Student support program" means a program administered pursuant to a memorandum of understanding with a school board for the purpose of providing direct services to at-risk students, including housing stabilization, case management, tutoring or instructional support, youth mentoring and development, or summer enrichment services.

"Targeted advertising" means advertising that is presented to a student and selected on the basis of information obtained or inferred over time from such student's online behavior, use of applications, or sharing of student personal information.

B. Any student support agency may enter into a memorandum of understanding with the local school board that governs any public elementary or secondary school through which the agency seeks to provide any student support program. Each such memorandum of understanding shall include:

1. Documentation establishing the organization's nonprofit status;

2. A copy of the organization's privacy policy and procedures, background check policy and procedures, and mandated reporting policy and procedures;

3. A description of each student support program that such organization provides;

4. Specific authorizations of the applicable school board relating to the transmission, collection, and use of student personal information by the student support agency;

5. Policies and procedures for the secure disposal of student personal information upon such student's withdrawal from a student support program, upon the cessation of any such program, or upon such student's graduation or transfer from the school division;

6. Requirements for the signed consent of the parent of any student or, in the case of a student who is 18 years of age or older, any student who participates in student support programs to the transmission of student personal information between school boards and the student support agency and to the transmission, collection, and use of such specific student's personal information as authorized pursuant to this subdivision; and

7. Standard consent forms and procedures to be used by such student support programs to obtain the necessary consent from the parent of any student or, in the case of a student who is 18 years of age or older, any student.

C. Each student support agency that operates a student support program in accordance with a memorandum of understanding with a local school board shall:

1. Conform to the provisions of the federal Family Educational Rights and Privacy Act (20 U.S.C. § 1232g) (FERPA);

2. Annually notify the parent of each student or, in the case of a student who is 18 years of age or older, the student, of the student's rights under FERPA and the provisions of this section;

3. Maintain a privacy policy relating to the security of student personal information that may be collected by the student support agency and provide prompt and prominent notice of any changes or updates made to such privacy policy to the applicable school board and to the parents of each student or, in the case of a student who is 18 years of age or older, each student receiving any support services through any such student support program;

4. Provide clear and accessible information to the applicable school board, to be distributed to each student or the parent of each student, detailing (i) the types of student personal information the student support agency collects through the provision of any student support program; (ii) how it maintains and transmits any student personal information collected in a manner that ensures the security, integrity, and confidentiality of such information; (iii) the uses for which any student personal information is collected by the student support agency; and (iv) the student support agency's privacy policy relating to the security of student personal information;

5. Maintain a comprehensive information security program that is reasonably designed to protect the security, privacy, confidentiality, and integrity of student personal information and makes use of appropriate administrative, technological, and physical safeguards;

6. Establish policies and procedures for facilitating access to and correction of student personal information collected, maintained, used, or shared by a student support agency, either directly or through a student's school or teacher, by the parent of each student or, in the case of a student who is 18 years of age or older, each student receiving student support services through the applicable student support program;

7. Collect, maintain, and use student personal information only (i) with the informed consent of the parent of each student or, in the case of a student who is 18 years of age or older, each student, receiving support services through the applicable student support program and (ii) for the purposes authorized pursuant to the memorandum of understanding executed in accordance with subsection B;

8. Require any successor nonprofit organization with which the student support agency shall exchange any student personal information to comply with the agency's privacy policies and procedures, the provisions of FERPA, and the provisions of this section;

9. Upon request of the parent of any student or, in the case of a student who is 18 years of age or older, any student securely dispose of all student personal information within 30 days of receiving the request;

10. Except as provided in subdivision 9, retain student personal information on behalf of each student from whom student personal information was collected pursuant to this section for three years after such student graduated, aged out of, transferred from, or otherwise left the applicable school division; and

11. In the event that the student support agency closes without any successor nonprofit organization, provide for the secure data transfer of any student personal information collected pursuant to this section to the school board of the school division in which each such student is or was enrolled, to be retained by the school board as a part of the student's scholastic record in accordance with § 22.1-289.

D. No student support agency that operates a student support program in accordance with this section shall knowingly:

1. Use or share or permit any affiliated platform or partner organization to use or share any student personal information for the purpose of targeted advertising or for any other purpose that is not essential to the provision of student support programs or otherwise authorized or permitted by this section;

2. Use or share any student personal information to create a personal profile of any student other than for student support programs without the consent of the parent of the student or, in the case of a student who is 18 years of age or older, the student;

3. Transfer or transmit any student personal information except as provided by this section; or

4. Retain any student personal information in violation of the provisions of subsection B.

E. Nothing in this section shall be construed to prohibit any student support agency from:

1. Using student personal information for adaptive learning or customized education purposes;

2. Using student personal information for maintaining, developing, supporting, improving, or evaluating the applicable student support program;

3. Using aggregate data collected in whole or in part from student personal information collected through providing any student support program for assessing student population needs and student support program performance;

4. Providing recommendations to any student through a student support program relating to employment, education, or purposes relating to learning or postsecondary achievement provided that any such recommendations are not in whole or in part determined by or based on consideration from a third party;

5. Disclosing student personal information (i) as necessary to comply with applicable state or federal law or regulation; (ii) to protect against liability; or (iii) to protect the security or integrity of the applicable student support program; or

6. Disclosing student personal information for the purpose of coordinating student support services with a governmental entity, provided that the student support agency, pursuant to a contract with the governmental entity, (i) prohibits such governmental entity from using any such student personal information for any purpose other than providing a student support service through or on behalf of the student support agency; (ii) prohibits such governmental entity from disclosing to any third party any student personal information provided by the student support agency, except to the extent such disclosure is permitted by subdivision C 7; and (iii) requires the governmental entity to comply with the provisions of this section, any policies and procedures developed in accordance with this section, or any other applicable federal or state law or regulation.

F. Each school board that enters into a memorandum of understanding with a student support agency to provide student support programs to students enrolled therein, pursuant to subsection B, shall transmit any of the student personal information, as authorized by the memorandum of understanding, to the student support agency within one calendar week of the date on which the school board receives from the parent of such student or, in the case of a student who is 18 years of age or older, the student's signed consent to the memorandum of understanding, pursuant to subsection B and, upon receiving any request for additional student personal information thereafter, within one calendar week of the date on which any such request was received, provided that the transmission of any such requested student personal information is permitted in accordance with the provisions of this section. However, in any case designated by the Department as an exceptional case, such requirement shall be waived and the transmission of such student personal information may be delayed. Upon designating any case as an exceptional case, the Department shall notify the requesting party of the delay and provide in such notification a timeline for the transmission of such student personal information The Department shall develop guidelines for determining whether a case should be designated as an exceptional case and for handling such exceptional cases.

G. Nothing in this section shall be construed to prohibit any school board from:

1. Establishing policies and procedures relating to the protection of student personal information that are more comprehensive than those required by the provisions of this section;

2. Requesting or receiving student personal information from any student support agency with which it has a memorandum of understanding, pursuant to subsection B, for the purpose of coordinating any applicable student support programs; or

3. Establishing a regional collaboration network with one or more school board that governs a contiguous school division and one or more student support agency providing any student support programs pursuant to this section for the purpose of facilitating resource sharing, providing compliance assistance, and collaborating to improve the efficiency and reduce the cost of delivering any such student support programs.

H. In the case of any data breach or unauthorized disclosure of any student personal information transmitted or collected by a student support agency in accordance with this section, such student support agency shall take immediate corrective action and promptly provide notice to the parent of each student or, in the case of a student who is 18 years of age or older, each student who was affected by such breach or unauthorized disclosure and to the applicable school board. Such notice shall be made (i) in writing to the residence of each such student or to the school board which, upon receipt of such notice, shall provide the notice directly to the student or his parent; (ii) by telephone; (iii) through e-mail; or (iv) upon demonstration by the student support agency that providing notice pursuant to clauses (i), (ii), or (iii) would be unduly burdensome due to cost or inability to obtain the requisite contact information for each affected individual in a reasonable amount of time, substitute notice by posting such notice conspicuously on the website of the student support agency and providing it to any major local and state news media.

I. No school board or public elementary or secondary school shall be liable for any civil damages for any acts or omissions resulting from any student support agency's noncompliance with the provisions of this section.

2. That the Department of Education shall (i) by the beginning of the 2027–2028 school year, develop a model memorandum of understanding and guidelines and policies for the implementation of such memorandum of understanding to facilitate and establish requirements and limitations relating to the exchange of student personal information between student support agencies and school boards in the Commonwealth; (ii) develop and make available to each school board and each student support program guidelines on recommended information and data security programs, systems, and protocols and best practices relating to information and data security; (iii) convene a stakeholder work group, including representatives of student support agencies, local school boards, and other relevant stakeholders to review the certification process proposed by the introduced version of House Bill 178; and (iv) no later than November 1, 2026, submit a report summarizing the activities of the work group and the work group's recommendations to the Governor and Chairs of the House Committee on Education and the Senate Committee on Education and Health.

3. That the provisions of this act shall not become effective unless reenacted by the 2027 Session of the General Assembly.